Vellor Privacy Policy

Last updated: June 26, 2026

This Privacy Policy explains how Ellis Tech LLC ("Vellor," "we," "us") collects, uses, shares, and protects information in connection with the Vellor website (vellorlegal.com) and application (vellor.legal) (together, the "Service"). It is part of, and incorporated into, our Terms of Service.

This policy describes our handling of information about website visitors and account holders. Information that you, as an attorney, submit about your own clients and matters ("Customer Data") is governed by our Terms of Service and our Data Security and Confidentiality statement; for that data we act as your service provider/processor and process it on your behalf and instructions.

1. Information we collect

  • Account information: name, email, firm name, role, and login credentials.
  • Billing information: processed by Stripe. We receive limited details such as your billing name, the last four digits and brand of your card, and transaction status. We do not store full card numbers.
  • Customer Data: the documents, client information, and content you submit to use the Service. See Section 6.
  • Usage and device data: log data, IP address, browser/device type, pages viewed, and feature usage, collected through cookies and similar technologies.
  • Communications: information you provide when you contact support or correspond with us.

2. How we use information

  • To provide, operate, maintain, secure, and improve the Service;
  • to process payments and manage subscriptions;
  • to communicate with you about your account, updates, and support;
  • to monitor for, prevent, and address security incidents, fraud, and misuse;
  • to comply with legal obligations and enforce our Terms.

We do not use your Customer Data to train general-purpose AI models.

3. Cookies and analytics

We use cookies and similar technologies for authentication, preferences, and security. We do not currently use analytics services, though we may add analytics (such as Google Analytics) in the future and will update this policy accordingly. You can control cookies through your browser settings; some features may not function without them. We do not currently use a cookie consent management tool, and we may add one as our user base or applicable requirements warrant.

4. How we share information

We share information only as needed:

  • Service providers (sub-processors) who help us operate the Service, under contracts requiring appropriate confidentiality and security. These include Stripe (payment processing), Vercel (application hosting and infrastructure), Supabase (database and storage), Resend (transactional and account email), and Anthropic (AI processing). We currently use Anthropic as our AI provider and may add or change AI providers and models over time, and we will update this policy at that time. A current list is maintained in our Data Security and Confidentiality statement.
  • Legal and safety: when required by law, subpoena, or to protect rights, safety, and the integrity of the Service.
  • Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

5. Data retention

We retain account and usage information for as long as your account is active and as needed for legitimate business, legal, tax, and accounting purposes. As general defaults: Customer Data is retained for the life of your account; after your account is terminated, we make Customer Data available for export for 30 days and then delete it within 90 days, unless a longer period is required by law or to resolve disputes or enforce our agreements. We retain billing and transaction records for up to 7 years to meet tax and accounting requirements. Security and server logs are generally retained for up to 12 months. Backups are purged on a rolling basis, generally within 90 days. You may request deletion of specific Customer Data as described in Section 6 and in our Data Security and Confidentiality statement.

6. Customer Data (client information you submit)

When you submit client documents and information, we process it on your behalf solely to provide the Service. You control that data, you are responsible for the rights and authorizations to submit it, and you may export or request deletion of it as described in the Terms. For details on confidentiality, security, sub-processors, and a Data Processing Addendum, see our Data Security and Confidentiality statement.

7. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure. See the Data Security and Confidentiality statement for details and breach-notification practices.

8. Your choices and rights

Depending on your state of residence, you may have rights regarding your personal information, including the rights to access or know what we collect, to correct inaccuracies, to delete your information, to receive a portable copy, and to opt out of the sale or sharing of personal information and of certain targeted advertising or profiling. As stated above, we do not sell your personal information and do not share it for cross-context behavioral advertising.

We honor these rights for all U.S. residents, regardless of state. They are provided under, among others, the California Consumer Privacy Act as amended by the CPRA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and comparable privacy laws in other states (including Texas, Oregon, Montana, Delaware, and others) as they come into effect. We will not discriminate against you for exercising any of these rights.

To make a request, contact us at support@ellisaitech.com. We will verify your request and respond within the timeframes required by applicable law. Where applicable law provides an appeal process, you may appeal a denied request by replying to our response.

9. Children's privacy

The Service is not directed to children under 18 and we do not knowingly collect their personal information.

10. International users

The Service is intended for and operated in the United States. We do not target or offer the Service to users in the United Kingdom, the European Union, or other countries outside the United States. If you access the Service from outside the United States, you do so on your own initiative, are responsible for compliance with local laws, and understand that your information will be processed in the United States.

11. Changes to this policy

We may update this policy. We will post the new effective date and, for material changes, provide additional notice.

12. Contact

Ellis Tech LLC — 1125 West St., Ste. 581, Annapolis, MD 21401 — support@ellisaitech.com